Immutability as an Operational Constraint Rather Than a Security Feature

Abstract

Immutability is being more and more identified as a fundamental trait of contemporary digital systems right from simple append-only logs and object storage to distributed ledgers and infrastructure-as-code. And it is mostly touted as a security measure in a very narrow sense that only by making tampering, preserving evidence, and trust enforcement in a hostile environment physically impossible can the security feature be justified. We think that such a portrayal is not only partial but, as a matter of fact, in many cases, far from the truth and we disprove it here by a thorough exposé of the issue. Our alternative proposition is that immutability should primarily be regarded as an operational design constraint, i.e. one that determines the very nature of how the systems are built, handled and recovered over time. We carry out, through a conceptual dissection buttressed with an empirical study, a thorough examination of the detrimental consequences of organizations blindly deploying immutable components without the necessary insight into what these components actually imply at the operational level. The analysis reveals that the principle of immutability brings about alterations in failure modes thereby generating new problems rather than doing away with the old ones: it is simply impossible to rectify errors "in situ, " the operation of rollback loses its simplicity, and the mistakes get duplicated through the execution of replication along with automation. The case study depicts the dual effects of immutable logs and storage that, on the one hand, enhance auditability but, on the other hand, pose difficulties of retention, cost escalation, slow incident response, as well as the challenge of governance of corrective actions. Major outcomes are along the lines of indicating that the major resultant consequences of immutability are felt in lifecycle management, versioning, reconciliation, and recovery workflows, thus it is not a matter of threat prevention per se.